MacSync Malware Exploits Apple iCloud Calendars to Hijack macOS Systems and AWS Credentials

A newly discovered variant of the Swift-based MacSync info-stealer is compromising macOS systems by hiding execution commands inside public iCloud calendar events. Attackers feed retrieved calendar data to the macOS zsh shell, where commands hidden after the event's DESCRIPTION line fetch an archive containing malware components. The infostealer specifically targets browser history, saved credentials, crypto wallet data, Telegram, the Keychain file, and AWS and Kubernetes configurations. A new Objective-C backdoor module disguises itself as the native macOS Finder and establishes system persistence through LaunchAgent and global Git hooks. The malware actively terminates native macOS notification processes to prevent any security alerts from reaching the user during the infection chain.